A PC operation log management product for monitoring operations of an information system by a user, detecting an operation designated by an administrator in advance (for example, writing information to removable media), and issuing an alert to the administrator has been conventionally used.
An example of an operation detection system for detecting a malicious operation or a suspicious operation is Patent Literature 1.